PT-2018-9743 · London Trust Media · Private Internet Access (Pia) Vpn Client

Fabius Watson + 1 · Publicado 2018-04-17 · Atualizado 2019-10-03 · CVE-2018-10190

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: London Trust Media Private Internet Access (PIA) VPN Client version v77

Description: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client could allow an unauthenticated, local attacker to run executable files with elevated privileges due to insufficient implementation of access controls. The Changelog and Help options from the system tray context menu spawn an elevated instance of the user's default web browser. An attacker could exploit this by selecting Run as Administrator from the context menu of an executable file within the file browser of the spawned default web browser, potentially allowing the execution of privileged commands on the targeted system.

Recommendations: For London Trust Media Private Internet Access (PIA) VPN Client version v77, consider disabling the Changelog and Help options from the system tray context menu as a temporary workaround until a patch is available. Restrict access to the default web browser's file browser to minimize the risk of exploitation. Avoid using the Run as Administrator option from the context menu of executable files within the spawned default web browser until the issue is resolved.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2018-10190

Produtos afetados

Private Internet Access (Pia) Vpn Client

Referências · 3

• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-019.md · Nota
• https://osv.dev/vulnerability/CVE-2018-10190 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-10190 · Nota de Segurança